docs(772): correct the twins of two claims this branch already fixed

Both remaining review findings were the same shape as the one before them, and it is the
shape this repo keeps recording: a claim corrected in one place, its copy left standing
somewhere else in the tree.

  * `docs/ci-cd.md` said "gates nothing" in the small-lane paragraph while the section 1441
    lines below said the opposite. A red preflight lands in the PR's combined status, which
    the merge gate reads (#598) — what it does not do is SKIP the jobs it diagnoses, and
    that is now the sentence in both places.
  * Two docstrings in the preflight's test file still described the disarmed script as
    warning and exiting 0. Built the mutant and ran it: it emits an error and exits 1. The
    exit code separates nothing now that an unverifiable answer fails too — the DIAGNOSTIC
    is what the mutation destroys, which is what `mutation_manifest.py` already said and
    the prose next to it contradicted.

Nits from the same pass: the admin-cron URL is quoted (`?` globs in zsh, the operator's
shell); the retry assertion's message quoted a threshold it does not use; the arm table
omitted the malformed-credential shape the code and tests both have; `buildx inspect` no
longer `--bootstrap`s a builder just to read its name, and an empty capture no longer
produces a noisy `buildx use ""`.

Swept the tree for the shape rather than the two reported lines: the surviving "exits 0"
and "could-not-tell" hits are other subsystems, or the concept named as a concept.

refs #772

scripts/tests/test_ci_toolchain_image_resolves.py

@@ -6,8 +6,10 @@ present, gone, and could-not-tell. Collapsing the third into either of the other
 becomes decoration, so each is driven here through the real entry point with a stubbed `curl`.
 
 `test_MUTATION_a_deleted_tag_is_reported_as_a_failure` is the load-bearing one and is declared in
-`scripts/tests/mutation_manifest.py`: disarming the `404` arm leaves a script that still runs, still
-prints, still exits 0 — and never reports the outage it exists for.
+`scripts/tests/mutation_manifest.py`. Note what it can and cannot turn on: since an unverifiable
+answer fails the job too, disarming the `404` arm still exits non-zero, so the EXIT CODE separates
+nothing. What the disarm destroys is the DIAGNOSTIC — the outage is reported as "could not verify",
+which sends an operator to the registry's health instead of to the rebuild that fixes it.
 """
 
 from __future__ import annotations
@@ -129,8 +131,8 @@ def test_MUTATION_a_deleted_tag_is_reported_as_a_failure(preflight):
     """The outage of 2026-08-11..13, in one assertion.
 
     Declared in `mutation_manifest.py`: replacing the `404` arm sends a deleted tag down the
-    could-not-tell path, where it warns and exits 0 — a preflight that runs, prints, and misses the
-    only thing it was built to catch.
+    could-not-verify path, which fails the job with the wrong story — a preflight that runs, reddens,
+    and still misses the only thing it was built to name.
     """
     preflight.set_codes({"32747a0": "404"})
     result = preflight.run()
@@ -296,6 +298,6 @@ def test_the_PRODUCTION_retry_defaults_are_the_ones_that_run(preflight):
     assert result.returncode != 0
     assert len(preflight.calls()) == 3, f"the default attempt count is not 3 — got {len(preflight.calls())} call(s)"
     assert elapsed >= 8, (
-        f"two pauses at the default 5s should take >=10s; took {elapsed:.1f}s, so the default pause "
+        f"two pauses at the default 5s should clear the 8s floor; took {elapsed:.1f}s, so the pause "
         "has been shortened out from under the 'a blip does not redden a PR' argument"
     )